Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spaces are deleted in some field data in standard output #1192

Closed
YamatoSecurity opened this issue Oct 19, 2023 · 0 comments · Fixed by #1199
Closed

Spaces are deleted in some field data in standard output #1192

YamatoSecurity opened this issue Oct 19, 2023 · 0 comments · Fixed by #1199
Assignees
Labels
invalid This doesn't seem right
Milestone

Comments

@YamatoSecurity
Copy link
Collaborator

When running this command:
./target/release/hayabusa csv-timeline -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/builtin/PowerShellClassic/PwShClassic_400_Info_PwShEngineStarted.yml
with this new rule:

author: Zach Mathis
date: 2023/10/18
modified: 2023/10/18

title: 'PwSh Engine Started'
description: 'Engine state is changed from None to Available.'

id: 8c58ee7c-d741-40ae-9af4-104d62e3b727
level: informational
status: test
logsource:
    product: windows
    service: powershell
detection:
    selection:
        Channel: 'Windows PowerShell'
        EventID: 400
    condition: selection
falsepositives:
tags:
references:
ruletype: Hayabusa

when I output to CSV: -o test-400.csv and check the results there are spaces just like the original log:
Example

"2021-01-28 19:40:54.884 +09:00","DESKTOP-ST69BPO","PwShClassic",400,"info",729,"PwSh Engine Started","Data: Available ¦ Data: NewEngineState=Available PreviousEngineState=None SequenceNumber=9 HostName=ConsoleHost HostVersion=2.0 HostId=5cbb33bf-acf7-47cc-9242-141cd0ba9f0c EngineVersion=2.0 RunspaceId=c6e94dca-0daf-418c-860a-f751a9f2cbe1 PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine= ¦ Data: None","Data: Available ¦ Data: NewEngineState=Available PreviousEngineState=None SequenceNumber=9 HostName=ConsoleHost HostVersion=2.0 HostId=5cbb33bf-acf7-47cc-9242-141cd0ba9f0c EngineVersion=2.0 RunspaceId=c6e94dca-0daf-418c-860a-f751a9f2cbe1 PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine= ¦ Data: None"

However, the standard output shows this:

2021-10-20 23:39:26.000 +09:00 ‖ FS03.offsec.lan ‖ PwShClassic ‖ 400 ‖ info ‖ 132 ‖ PwSh Engine Started ‖ Data: Available ¦ Data: NewEngineState=AvailablePreviousEngineState=NoneSequenceNumber=13HostName=ConsoleHostHostVersion=4.0HostId=63c2be9c-cd2c-46d7-ac07-01a9e98f2400HostApplication=powershell.exe -NoP -C C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id \Windows\Temp\vtnr8kff.dmp full;Wait-Process -Id (Get-Process rundll32).idEngineVersion=4.0RunspaceId=1668d864-c13c-442c-bf70-3fe6a4dee2caPipelineId=CommandName=CommandType=ScriptName=CommandPath=CommandLine= ¦ Data: None ‖ Data: Available ¦ Data: NewEngineState=AvailablePreviousEngineState=NoneSequenceNumber=13HostName=ConsoleHostHostVersion=4.0HostId=63c2be9c-cd2c-46d7-ac07-01a9e98f2400HostApplication=powershell.exe -NoP -C C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id \Windows\Temp\vtnr8kff.dmp full;Wait-Process -Id (Get-Process rundll32).idEngineVersion=4.0RunspaceId=1668d864-c13c-442c-bf70-3fe6a4dee2caPipelineId=CommandName=CommandType=ScriptName=CommandPath=CommandLine= ¦ Data: None

I want to keep spaces between CommandName=, CommandType=, etc...

@hitenkoku Could you check this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
invalid This doesn't seem right
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants